CertGuru

.crt, .cer and .cert files

There is no technical difference between `.crt`, `.cer` and `.cert`. All three mean "this file is an X.509 certificate" and none of them says anything about the encoding, which may be PEM text or binary DER. `.crt` is the Unix convention and `.cer` is the Windows one, but both platforms read either. The only reliable way to know what you have is to look at the first byte — a `-` means PEM, `0x30` means DER.

Updated August 19, 2026 Verified against OpenSSL 3.5.7

The short answer #

Extension Means Encoding Convention
.crt A certificate PEM or DER Unix / Linux
.cer A certificate PEM or DER Windows
.cert A certificate PEM or DER Occasional
.pem Base64-wrapped anything PEM by definition Cross-platform
.der Binary ASN.1 anything DER by definition Cross-platform

The first three rows are interchangeable. The distinction that actually matters is not in that column at all — it is the encoding, and none of the certificate extensions record it.

Find out what you have #

One command answers it
file certificate.crt
Expected output 
certificate.crt: PEM certificate

Without file:

head -n1 certificate.crt

A line of dashes means PEM. Unreadable bytes mean DER.

Definitive check on the first byte
head -c 1 certificate.crt | xxd -p
Expected output 
30

30 is DER. 2d is a - character, so PEM.

Why Windows makes this worse #

The Windows certificate export wizard offers three options and writes all of them as .cer unless you intervene:

  • DER encoded binary X.509 — binary.
  • Base-64 encoded X.509 — PEM.
  • Cryptographic Message Syntax Standard – PKCS #7 — a P7B bundle, written as .p7b.

So a .cer from a Windows colleague is a coin flip, and the third option is not a bare certificate at all. Always check before assuming.

What to do with each #

Nothing to convert. Rename it if a tool insists on a particular extension:

cp certificate.crt certificate.pem

To normalise it — stripping any stray text, bag attributes or trust settings:

openssl x509 -in certificate.crt -out certificate.pem

Convert to PEM before using it with anything that expects text:

openssl x509 -inform der -in binary.crt -out certificate.pem

Full detail at convert DER to PEM.

Inspecting one either way #

Works regardless of extension, once you know the encoding
openssl x509 -in certificate.crt -noout -subject -issuer -dates
Extension What it usually is
.key A private key, usually PEM. See key files
.csr A certificate signing request
.p7b, .p7c A PKCS#7 bundle — certificates only
.pfx, .p12 A PKCS#12 archive — usually includes a key
.jks A Java keystore
.ca-bundle, .chain Concatenated PEM intermediates

Frequently asked questions

Is .crt the same as .pem?
Often, but they answer different questions. .pem describes an encoding; .crt describes a role. A .crt file is usually PEM-encoded, in which case renaming it to .pem changes nothing — but it can equally be DER, in which case renaming produces a broken file.
Which extension should I use for a new file?
.crt for a PEM certificate on Unix, .pem if you want the encoding to be obvious, and .der for binary. Avoid .cer for anything new, because it is used for both encodings and communicates nothing.
Can a .crt file contain a private key?
It should not, and by convention it does not. If grep "PRIVATE KEY" finds a match in a file someone sent you as a certificate, treat that key as compromised and reissue.
Does nginx or Apache care about the extension?
No. Both read whatever path is configured and detect the encoding from the file contents. Extensions exist for humans.

References

Related pages